Security Advisory: Critical PHP Vulnerabilities

Superintendents,
 

We are providing this update to Superintendents and public school system technology leaders to address the critical PHP vulnerabilities. 
 

Advisory: Critical PHP Vulnerabilities (PHP2Shell) - Immediate Review and Remediation Recommended 

Executive Summary

Two critical vulnerabilities affecting PHP, commonly referred to as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), have recently been identified. Public reporting indicates these vulnerabilities may allow an unauthenticated attacker to execute code remotely on affected web servers, potentially leading to complete compromise of vulnerable internet-facing systems. Patched versions have been released for supported PHP versions, and public proof-of-concept exploit code is available. 

Because PHP is widely used to support websites, web applications, learning platforms, content management systems, and custom-developed applications, all Texas school systems should immediately review their technology inventories to identify any systems utilizing PHP and assess their exposure. 

Situational Awareness

Within hours of the vulnerability disclosure, researchers reported observing exploit attempts on vulnerable PHP instances, underlying the importance of expeditiously addressing the vulnerability.  Texas Cyber Command will continue monitoring for malicious activity and may take protective actions where appropriate; however, organizations should not rely solely on external protections and should assume that attempts to identify and exploit vulnerable systems will continue to increase. 

School systems are strongly encouraged to take immediate action to identify potentially affected systems and evaluate remediation options.

Recommended Actions

1. Identify Potentially Affected Systems 

Conduct an inventory review to determine whether your environment includes systems using PHP. Particular attention should be given to internet-accessible systems. 

2. Determine Version and Exposure 

For each identified system: 

• Verify the installed PHP version. 

• Determine whether the system is accessible from the public internet. 

• Confirm whether updates or vendor-provided patches are available. 

3. Apply Updates as Quickly as Possible 

Organizations should prioritize patching affected systems as soon as operationally feasible. 

Where systems support critical business, instructional, or operational functions, technology leaders should carefully evaluate maintenance windows, downtime requirements, and service impacts; however, the risk posed by continued exposure should be weighed against the potential disruption associated with emergency maintenance. 

4. Consider Additional Risk Reduction Measures 

If immediate patching is not possible: 

• Limit public internet exposure where feasible. 

• Implement temporary compensating controls. 

• Increase monitoring of application, web server, and security logs. 

• Review vendor guidance for any available mitigations. 

5. Evaluate Whether Temporary Service Interruption Is Warranted 

For highly exposed systems that cannot be patched in a reasonable timeframe, organizations should evaluate whether temporarily removing a system from public internet access presents less risk than continued operation in a vulnerable state. 

This determination should consider: 

• The criticality of the application. 

• Availability of alternative services or processes. 

• Potential impact to instruction and business operations. 

• The likelihood and consequences of compromise. 

Why This Matters

Successful exploitation could allow an attacker to gain control of the web application process, access sensitive information, modify website content, deploy malicious software, establish persistence, or use the compromised system as a foothold for further activity within the environment. Public reporting indicates that exploitation may be possible without authentication and that vulnerability scanning and exploitation activity are expected to increase rapidly following disclosure. 

Conclusion

All Texas school systems are encouraged to immediately review their application inventory, identify any systems utilizing PHP, determine exposure to these vulnerabilities, and implement vendor-provided updates or other appropriate mitigations as quickly as possible. Early identification and remediation remain the most effective means of reducing risk from this threat. 

If you have questions or observe suspicious activity related to this incident, please contact the TEA cybersecurity team: cybersecurity@tea.texas.gov.